CVE-2024-1004 Overview
CVE-2024-1004 is a stack-based buffer overflow [CWE-121] in the Totolink N200RE router running firmware version 9.3.5u.6139_B20201216. The flaw resides in the loginAuth function inside /cgi-bin/cstecgi.cgi. Attackers manipulate the http_host argument to overflow a stack buffer. The vulnerability is exploitable over the network and the exploit has been publicly disclosed. Totolink was contacted about this issue but did not respond to the disclosure.
Critical Impact
Remote attackers with valid credentials can trigger a stack buffer overflow through the http_host parameter, potentially achieving code execution on affected routers.
Affected Products
- Totolink N200RE hardware device
- Totolink N200RE firmware version 9.3.5u.6139_B20201216
- Deployments exposing the /cgi-bin/cstecgi.cgi web management interface
Discovery Timeline
- 2024-01-29 - CVE-2024-1004 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-1004
Vulnerability Analysis
The vulnerability exists in the loginAuth handler served by /cgi-bin/cstecgi.cgi on the Totolink N200RE web management interface. The handler processes HTTP request headers and copies the http_host value into a fixed-size stack buffer without validating the input length. Supplying an oversized value overwrites adjacent stack memory, including saved return addresses and control data.
Because the router runs on an embedded Linux stack, this class of memory corruption can result in denial of service or arbitrary code execution on the device. Successful exploitation grants control of the network gateway, enabling traffic interception, DNS manipulation, and lateral movement into the local network. Additional technical context is available in the Jylsec Security Report and the VulDB #252273 Details entry.
Root Cause
The root cause is missing bounds checking on the http_host argument inside loginAuth. The function uses an unsafe string copy into a stack-allocated buffer, matching the classic [CWE-121] stack-based buffer overflow pattern common in MIPS-based embedded routers.
Attack Vector
An authenticated attacker sends a crafted HTTP request to /cgi-bin/cstecgi.cgi with an oversized Host header or http_host parameter. The request is reachable over the network wherever the management interface is exposed. Exploitation requires high privileges according to the CVSS vector, which restricts practical attackers to those who already hold administrative credentials or can obtain them through a separate weakness.
No verified proof-of-concept code is included here. Refer to the VulDB #252273 Exploit Information for published exploit references.
Detection Methods for CVE-2024-1004
Indicators of Compromise
- HTTP requests to /cgi-bin/cstecgi.cgi containing abnormally long Host headers or http_host parameters exceeding typical DNS name lengths
- Unexpected router reboots, watchdog resets, or httpd process crashes recorded in syslog
- Outbound connections from the router to unfamiliar external hosts following administrative logins
Detection Strategies
- Inspect web server and CGI logs on the router for requests targeting loginAuth with oversized header values
- Deploy network intrusion detection rules that flag HTTP requests to cstecgi.cgi where the Host header exceeds 255 bytes
- Correlate authentication events with subsequent process crashes on the device
Monitoring Recommendations
- Forward router syslog to a central log platform and alert on httpd or cstecgi process termination
- Monitor administrative interface access from non-management VLANs and unexpected source IPs
- Track firmware version inventory to identify devices still running 9.3.5u.6139_B20201216
How to Mitigate CVE-2024-1004
Immediate Actions Required
- Restrict access to the router web management interface to trusted management networks only
- Disable remote WAN-side administration on all Totolink N200RE devices
- Rotate administrator credentials and enforce strong, unique passwords to raise the bar against the high-privilege prerequisite
- Segment vulnerable devices from sensitive internal assets until a fix is available
Patch Information
No vendor patch has been published. Totolink did not respond to the disclosure according to the VulDB #252273 Details advisory. Organizations should monitor the Totolink support portal for future firmware updates addressing the loginAuth handler and consider replacement with a supported device if no fix is released.
Workarounds
- Block inbound access to /cgi-bin/cstecgi.cgi from untrusted networks at an upstream firewall
- Place the router management VLAN behind a jump host requiring multi-factor authentication
- Disable HTTP administration and require VPN access for any configuration changes
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
